Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 21:

  Which Splunk component performs indexing and responds to search requests from the search head?

  A. Forwarder

  B. Search peer

  C. License master

  D. Search head cluster

  Correct Answer: B

  https://docs.splunk.com/Splexicon:Searchpeer

  A Splunk platform instance that responses to search requests from a search head. The term "Search peer" is usually synonymous with the indexer role in a distributed search topology...

• Question 22:

  Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)

  A. _license

  B. _lnternal

  C. _external

  D. _thefishbucket

  Correct Answer: BD

  https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Howindexingworks

• Question 23:

  How often does Splunk recheck the LDAP server?

  A. Every 5 minutes

  B. Each time a user logs in

  C. Each time Splunk is restarted

  D. Varies based on LDAP_refresh setting.

  Correct Answer: B

  https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/ManageSplunkuserroleswithLDAP

• Question 24:

  Where are license files stored?

  A. $SPLUNK_HOME/etc/secure

  B. $SPLUNK_HOME/etc/system

  C. $SPLUNK_HOME/etc/licenses

  D. $SPLUNK_HOME/etc/apps/licenses

  Correct Answer: C

• Question 25:

  In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

  A. To ensure that hot buckets are still open for writes and have not been forced to roll to a cold state

  B. To ensure that configuration files have not been tampered with for auditing and/or legal purposes

  C. To ensure that user passwords have not been tampered with for auditing and/or legal purposes.

  D. To ensure that data has not been tampered with for auditing and/or legal purposes

  Correct Answer: D

• Question 26:

  What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

  A. REGEX, DEST. FORMAT

  B. REGEX. SRC_KEY, FORMAT

  C. REGEX, DEST_KEY, FORMAT

  D. REGEX, DEST_KEY FORMATTING

  Correct Answer: C

  REGEX =

  *

  Enter a regular expression to operate on your data. FORMAT =

  *

  NOTE: This option is valid for both index-time and search-time field extraction. Index-time field extraction configuration require the FORMAT settings. The FORMAT settings is optional for search-time field extraction configurations.

  *

  This setting specifies the format of the event, including any field names or values you want to add. DEST_KEY =

  *

  NOTE: This setting is only valid for index-time field extractions.

  *

  Specifies where SPLUNK software stores the expanded FORMAT results in accordance with the REGEX match.

• Question 27:

  Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

  A. Any OS platform

  B. Linux platform only

  C. Windows platform only.

  D. None of the above.

  Correct Answer: A

  "The forwarder/indexer relationship can be considered platform agnostic (within the sphere of supported platforms) because they exchange their data handshake (and the data, if you wish) over TCP.

• Question 28:

  Which valid bucket types are searchable? (select all that apply)

  A. Hot buckets

  B. Cold buckets

  C. Warm buckets

  D. Frozen buckets

  Correct Answer: ABC

  Hot/warm/cold/thawed bucket types are searchable. Frozen isn't searchable because its either deleted at that state or archived.

• Question 29:

  How do you remove missing forwarders from the Monitoring Console?

  A. By restarting Splunk.

  B. By rescanning active forwarders.

  C. By reloading the deployment server.

  D. By rebuilding the forwarder asset table.

  Correct Answer: D

• Question 30:

  What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

  A. License data

  B. Metricsdata

  C. Internal Splunk data

  D. Internal Windows logs

  Correct Answer: B